Credit Card Statement Privacy Policy and File Handling

Your choices in one minute

A guest analysis is temporary; profile storage begins only after an explicit save choice. Uploaded statements never become public pages or source material for the guide library.

Statement uploads and analysis

The service reads the text or rendered pages needed to produce the analysis you requested. The source file, extracted rows, calculations, notes, and review state remain private to the temporary session or signed-in profile. Upload only a document you are authorized to process.

Temporary guest material

The result, user-entered notes, and an encrypted copy that enables profile claiming are held with restricted permissions for up to 30 minutes. The result URL is private, excluded from indexing, and can be erased before expiry.

What saving a statement retains

When a signed-in user selects Save, the profile may retain the encrypted source, extracted transactions, statement period, totals, transaction and statement notes, review confirmations, reviewer comments, and review timestamps. Deleting or expiring the statement removes its connected analysis, workpaper, notes, and rows. Keep separate records required for tax, legal, or accounting duties.

Synthetic generator data

The fictional statement generator runs in the browser. Names, dates, descriptions, directions, and values typed into that form are not submitted to this server. Reloading clears the draft, and output carries permanent synthetic-document markings and a fixed demonstration reference.

Usage enforcement and saved rules

We record monthly upload counts and short rate-limit windows so concurrent requests cannot exceed plan allowances. Signed-in activity uses the profile ID; guest requests use a random session value stored only as a one-way hash. Those counters contain no statement text. If a user chooses to remember a category correction, the saved rule contains a reduced description pattern and the selected category.

Planning workspace data

A profile can contain budgets, savings goals, account labels, recurring-payment decisions, and generated summaries. Forecasts use simple past-period baselines and neither move funds nor promise an outcome. These records remain connected to the profile until deletion or the applicable underlying-data retention event.

Households and shared budgets

An owner can send an expiring invitation restricted to a specified email; the invitation token is stored as a one-way hash. A member chooses whether calculated monthly totals contribute to household views. Other members cannot view that person's source statement, private note, or full descriptor. Shared totals exclude identified transfers and duplicates and keep currencies apart. Members may stop contribution or leave, and owners may remove access.

Currency calculation records

A saved conversion may include source amount and currency, destination currency, rate, source name, optional link, date, note, and result. The creator decides whether an active household can see it. The calculation does not edit extracted transactions or automatically combine currencies, and only its creator can remove the record.

Referrals

A referral record links the referring and new profile IDs with qualification status, timestamps, and reward month. Qualification requires a valid completed analysis by a new user and is limited by the program rules. No statement, descriptor, balance, amount, or analysis result is stored in the referral record.

Optional email reminders

Missing-statement and monthly-summary messages are off until enabled in Account Settings. They do not include transaction text, balances, totals, or attachments. Delivery records contain the profile ID and job state needed to prevent duplicates and investigate failures.

Operational and audit logs

Limited events such as a completed upload, report build, or export use approved properties that omit file names, email addresses, transaction text, and financial amounts. Private audit entries use action names and internal IDs to trace profile changes. Eligible permanent account deletion removes these records.

Billing through Stripe

Stripe processes checkout, subscriptions, report purchases, payment methods, invoices, renewals, refunds, and billing-portal access. This site retains the Stripe customer and purchase references, selected plan and interval, access status, cancellation choice, payment reference, and report-credit usage. It never stores the complete payment-card number. Stripe handles billing information under its own policy.

Merchant identification request

Merchant lookup uses reduced descriptor text after digits, long references, emails, URLs, card endings, and routine issuer terms are removed. The request omits the document, transaction dates, amounts, balances, account identity, and user profile. Any returned identity, category, explanation, or link is a suggestion that may remain unresolved.

Dashboard and tax worksheet calculations

Saved extracted rows can produce category totals, monthly inflow and outflow views, recurring candidates, balance ranges, period coverage, reconciliation status, and exception counts. Comparisons depend on readable dates and consistent account identity, so missing fields can make them incomplete.

Tax-scenario arithmetic runs locally in the browser. Country, year, rate, selected rows, and allowable percentages from that worksheet are not transmitted to this site. Compare every result with the issued statement and current official rules.

Cookieless visitor analytics

We use self-hosted Matomo to understand visits to public pages. Matomo is configured without analytics cookies and honors the browser's Do Not Track setting. It receives the standard technical request data needed to count and diagnose visits, but it is not used to follow you across unrelated websites.

Advertising and cookies

If advertising is enabled on public information pages, Google and other vendors may then place cookies to serve personalized or non-personalized ads according to user choice and applicable law. Google Ads Settings provides advertising controls.

Where consent is required in the EEA, United Kingdom, or Switzerland, personalized advertising will remain disabled until consent is collected through an active Google-certified consent platform that serves as the site's consent management platform.

Service providers

Approved processors receive only the data necessary for their task. Statement analysis may require readable text or rendered pages; merchant identification receives only the reduced descriptor described above. Configuration, access controls, and contracts restrict their use.

Security and practical limits

Safeguards include encrypted transport, encryption for stored profile files, private result addresses, session binding, authorization checks, upload limits, and timed removal of guest output. No internet service can promise absolute security. Remove unnecessary fields before upload and follow the redaction and secure-sharing learning path when a copy must leave your control.

Access, correction, deletion, and contact

Use the privacy request page to ask about accessing, correcting, or removing profile information. Never email a statement or full account number. Rights depend on location and the service relationship; related responsibilities appear in the Terms of Use.

Deleting an account

After email confirmation, an eligible signed-in user can permanently delete the profile in Account Settings. This removes encrypted statements, analyses, rows, notes, confirmations, budgets, goals, reports, recurring decisions, reminders, usage counters, rules, conversions, household records, referrals, and eligible logs. Manage any active paid subscription in the billing portal first so future billing status is clear.